Group policy is a concept that enables various user and computer settings to be defined and managed centrally on a network. In the Microsoft Windows environment, “Group Policy” and “Active Directory” services infrastructure enable information technology (IT) administrators to automate one-to-many management of users and computers—simplifying administrative tasks and reducing management costs.
Group policy has many advantages including centralizing computer system settings for various computer systems at a domain, site and/or organizational unit (OU) level in order to enforce uniformity across the computer systems; allowing the application of different policies to different sites, domains and OUs in order to manage, e.g., different sets of users; enabling user desktop environments to be managed in order to reduce, e.g., time spent troubleshooting configuration problems; enabling the installation, update, repair and removal of software on various computer systems to be centrally managed; and enabling the creation and management of account policies, configuration policies, audit policies and other security features in order to manage the security of computers and users in, e.g., a domain.
Group policy objects (GPOs) are often employed to implement certain policies on a computer system. A GPO is a structure that contains a collection of computer settings associated with a group policy. For example, a GPO may contain settings that determine access rights and privileges for a particular user when the user logs into a computer system. GPOs may be configured to perform various management tasks on a computer system, such as distributing registry settings, distributing security settings and/or deploying software. Further, GPOs may be configured to implement other policy related functions, such as establishing roaming user profiles and redirecting file system folders to, e.g., a network share file system. In a typical arrangement, a system administrator creates a GPO and targets it to a particular site, domain and/or organizational unit. The GPO is delivered to the appropriate computer systems which are then configured according to the contents of the GPO.
GPOs are stored on the domain controllers or on the client machines; GPOs stored on client machines are called local GPOs or LGPOs. Policy settings are acquired from both the GPOs on the domain controller (DC) and from the local GPOs and applied to the system.
A GPO may be organized into various types of policies including, for example, administrative templates, folder redirection, security settings, and software installation. Each policy type may, in turn, be configured to support a number of policy settings. For example, a GPO may contain administrative template settings that both hide icons on a user's desktop and prevent the user from running certain applications.
Policy settings are applied to a computer system when the system is started, a user logs into the system, a user logs out of the system or when the system is shut down. Additionally the settings for the system and user may be refreshed at regular intervals. For DCs, the policy settings are typically refreshed every five minutes. For client computers, the policy settings are typically refreshed every ninety minutes plus a random offset of up to thirty minutes. In addition, certain policy settings, such as policy settings associated with software installation and folder redirection, may be applied only when the system starts up or when a user logs into the system, and are not refreshed periodically.